Executive brief
FastSchema is a backend-as-a-service platform with headless CMS capabilities used to manage application data and content. A timing flaw in the account recovery flow allows attackers to bypass protections against repeated incorrect OTP attempts, enabling brute-force attacks against 6-digit one-time passwords without authentication. This could allow an attacker to gain unauthorized access to user accounts.
Technical details
A time-of-check/time-of-use (TOCTOU) race condition exists in the account recovery OTP validation logic in FastSchema through v0.15.1. The vulnerability allows an unauthenticated remote attacker to bypass rate-limiting or attempt-count restrictions on OTP verification by exploiting a window between when the system checks the attempt limit and when it increments the counter. An attacker can rapidly submit multiple OTP guesses from different requests to brute-force 6-digit codes (1 million possibilities) before the limit is enforced. No authentication is required; the attack is triggered over the network during account recovery. A patch is expected in later versions beyond v0.15.1.
Affected products
- FastSchema FastSchema through v0.15.1
Timeline
- 2026-08-10: disclosed